DNS fundamentals

DNS Explained: The Internet's Phone Book

How DNS turns names into addresses, what every record type does, why propagation feels slow, and how to diagnose and secure your zone — written for operators who need to fix things and developers who want to understand what's actually happening on the wire.

Run a DNS lookup

Quick summary

  • DNS maps names to addresses via a hierarchy of authoritative and recursive servers.
  • Propagation feels slow because of TTL-based caching, not because changes are slow to apply.
  • A, AAAA, CNAME, MX, TXT, NS, and SOA cover 95% of operational needs.
  • DNSSEC + DoH/DoT defend against tampering and snooping.

The lookup, step by step

Your device asks its configured recursive resolver. The resolver checks its cache; if empty, it queries the root servers, then the TLD servers (.com, .org), then the authoritative nameservers for the zone. Each hop returns a referral until the final answer arrives. The resolver caches the answer for the TTL and hands it back to your device.

Record types you actually use

  • A / AAAA — IPv4 and IPv6 addresses for a hostname.
  • CNAME — alias to another hostname (CDNs love these).
  • MX — mail exchanger with priority. Required to receive email.
  • TXT — free-form text. Hosts SPF, DKIM, DMARC, and verification tokens.
  • NS — which servers are authoritative for the zone.
  • SOA — serial, refresh, retry, expire, and zone metadata.
  • CAA — which certificate authorities are allowed to issue for your domain.

Propagation, TTLs, and the cache problem

Lower TTLs before a planned change so resolvers re-query quickly. Raise them back afterward to reduce query volume. Tools that bypass caches (a fresh resolver, DoH probes) let you confirm the authoritative answer immediately instead of waiting hours.

DNS security: DNSSEC, DoH, DoT

DNSSEC signs records so a resolver can detect tampering. DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) encrypt the transport so observers on the path can't see or modify your queries. The two are complementary — use both for sensitive workloads.

Troubleshooting workflow

Run through these steps in order. Each step links to the right diagnostic tool.

  1. 1

    Resolve the record

    Inspect A, AAAA, CNAME, MX, TXT, NS, SOA in one shot.

    Open DNS Lookup
  2. 2

    Reverse the IP

    Confirm rDNS for mail servers and verify FCrDNS alignment.

    Open Reverse DNS
  3. 3

    Check propagation

    Compare authoritative truth vs cached responses.

    Open DNS lookup landing
  4. 4

    Validate downstream

    After DNS resolves, confirm HTTPS, blacklist, and reputation.

    Open Website Safety

Recommended next steps

Troubleshoot DNS errors

Fix DNS problems

DNS monitoring guide

Website security checks

Internet intelligence playbook

Network troubleshooting

Frequently asked questions

What is DNS in plain English?

DNS (Domain Name System) translates human-readable names like example.com into the IP addresses computers actually route to. It's the lookup layer that makes the web usable.

Why does DNS propagation take so long?

Every record carries a TTL (time to live). Resolvers along the path cache the answer until the TTL expires. Until then they keep serving the old value, which is why changes feel gradual even though the authoritative server updated instantly.

What is the difference between A, AAAA, CNAME, and MX records?

A points a name to an IPv4 address. AAAA points a name to an IPv6 address. CNAME aliases one name to another. MX tells the world where to deliver email for the domain.

What is DNSSEC and do I need it?

DNSSEC cryptographically signs DNS responses so resolvers can detect tampering. It's strongly recommended for any domain that handles email, finance, or trust-sensitive workloads.

Why is my site loading slowly — is DNS the cause?

It can be. A slow recursive resolver, a long CNAME chain, or an unhealthy authoritative server adds latency to the very first request. A DNS lookup tool will show the resolution time per server.

What is a recursive resolver vs an authoritative server?

Authoritative servers hold the truth for a zone. Recursive resolvers (like 1.1.1.1 or 8.8.8.8) do the legwork of walking the DNS tree on behalf of your device and caching the answer.

Monitor it continuously

Save this check, get alerts on changes, and track multiple domains in one dashboard.

Learn about monitoring